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Amendments to the Claims: 

This listing of claims will replace all prior versions, and listings, of claims in the application: 

1. (Currently amended) A security method for controlling access to a function of a digital television 
receiver, comprising the steps of: 

(a) providing a software application at the receiver; 

said software application being executable in response to an execution command; 

(b) receiving data at the receiver fi-om a headend, said data defining a condition of the 
receiver under which access to the receiver ftinction by the software application is permitted; 

(c) receiving information at the receiver from the headend, said information defining a 

security policy for said software application which contains a set of permissions for said software 
application; 

(d) providing a control signal for requesting access to the receiver ftonction upon execution 
of said software application; 

(e) in response to said control signal, determining whether the security policy for the 
software application contains a permission for the software application to access the receiver 
function; 

(f) if said security policy contains said permission: 

(i) determining whether said condition of the receiver is met by data indicative of a 
current state of the receiver; 

(ii) allowing the software application to access the receiver ftonction if the condition 
is met; and 

(iii) preventing the software application fi-om accessing the receiver fimction if the 
condition is not met; and 

(g) if said security policy does not contain said permission, preventing the software 
application from accessing the receiver ftinction; 

wherein said condition of the receiver indicates a conditional access state of the receiver. 
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2. (Cancelled) 

3. (Currently amended) The method of claim 3 1, wherein said conditional access state comprises at 
least one of: 

a blackout state; 

a pay-per-view state; and 

an authorization state. 

4. (Currently amended) Th e m e thod of claim 1, A security method for controlling access to a 
function of a digital television receiver, comprising the steps of: 

(a) providing a software application at the receiver; 

said software application being executable in response to an execution command; 
fb) receiving data at the receiver from a headend, said data defining a condition of the 
receiver under which access to the receiver function by the software application is permitted; 

(c) receiving information at the receiver from the headend, said information defining a 

security policy for said software application which contains a set of permissions for said software 
a pplication; 

(d) providing a control signal for requesting access to the receiver function upon execution 
of said software application; 

(e) in response to said control signal determining whether the security policy for the 
software application contains a permission for the software application to access the receiver 
fiinction; 

(f) if said security policy contains said permission: 

(i) determining whether said condition of the receiver is met by data indicative of a 
current state of the receiver; 

(ii) allowing the software application to access the receiver fiinction if the condition 
is met; and 
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(iii) preventing the software application from accessing the receiver function if the 
condition is not met: and 

(g) if said security policy does not contain said permission, preventing the software 
a pplication from accessing the receiver fiinction; 
wherein: 

said condition of the receiver indicates a user state of the receiver : and 
said user state comprises at least one of: 

user preferences: 

a user password: and 

a user identifier . 

5. (Cancelled). 

6. (Currently amended) The method of claim $ 4, wherein: 

said condition of the receiver indicates at least one of a time, date, and day. 

7. (Currently amended) The method of claim 4- 8, wherein: 

said condition of the receiver is defined, at least in part, by said software application. 

8. (Currently amended) Th e m e thod of claim 1, wh e r e in: A security method for controlling access 
to a fiinction of a digital television receiver, comprising the steps of: 

fa) providing a software application at the receiver: 

said software application being executable in response to an execution command: 

(b) receiving data at the receiver fi-om a headend, said data defining a condition of the 
receiver under which access to the receiver function by the software application is permitted: 

(c) receiving information at the receiver from the headend, said information defining a 

security policy for said software application which contains a set of permissions for said software 
application: 
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(d) providing a control signal for requesting access to the receiver function upon execution 
of said software application: 

(e) in response to said control signal determining whether the security policy for the 
software application contains a permission for the software application to access the receiver 
fimction; 

(f) if said security policy contains said permission: 

ri) determining whether said condition of the receiver is met by data indicative of a 
current state of the receiver; 

(ii) allowing the software application to access the receiver function if the condition 
is met; and 

fiii) preventing the software application from accessing the receiver ftinction if the 
condition is not met; and 

(g) if said security policy does not contain said permission, preventing the software 
application from accessing the receiver ftinction; 

wherein said condition of the receiver indicates that one of a channel and a group of 
channels is tuned by the receiver. 

9. (Currently amended) The method of claim 4- 8, wherein: 

the software application is downloadable to the receiver via a broadband television network. 

10. (Cancelled). 

1 1 . (Currently amended) The method of claim 4- 8, wherein: 

the software application comprises a Java code. 



12. (Currently amended) The method of claim 4- 8, wherein: 
the execution command is initiated by a user. 
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13. (Currently amended) The method of claim 4- 4, wherein: 

the permission is associated with a user of the receiver. 



14. (Currently amended) The method of claim 4- 8, wherein: 

the condition of the receiver is embedded in code that defines the permission. 



15. (Currently amended) The method of claim 4 8, wherein: 

the software application is multicast to a receiver population including said receiver. 



16. (Cancelled). 



17. (Currently amended) A security apparatus for controlling access to a ftinction of a digital 
television receiver, comprising: 

(a) means for providing a software application at the receiver; 

said software application being executable in response to an execution command; 

(b) means for receiving data at the receiver from a headend, said data defining a condition 
of the receiver under which access to the receiver ftinction by the software application is permitted; 

(c) means for receiving information at the receiver from the headend, said information 

defining a security policy for said software application which contains a set of permissions for 
said software application; 

(d) means for providing a control signal for requesting access to the receiver ftinction upon 
execution of said software application; 

(e) means for determining, in response to said control signal, the security policy for the 
software application contains a permission for the software application to access the receiver 
ftinction; 

(f) (i) means for determining whether said condition of the receiver is met by data indicative 
of a current state of the receiver when said security policy contains said permission; 

(f)(ii) means for allowing the software application to access the receiver ftinction if the 
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condition is met, and when said security policy contains said permission; 

(f) (iii) means for preventing the software application fi-om accessing the receiver Sanction if 
the condition is not met, and when said security poHcy contains said permission; and 

(g) means for preventing the software application fi-om accessing the receiver function if 
said security policy does not contain said permission; 

wherein said condition of the receiver indicates that one of a channel and a group of 
channels is tuned by the receiver . 



